CVE-2024-30403 MEDIUM

CVE-2024-30403: Junos OS Evolved: When MAC learning happens, and an interface gets flapped, the PFE crashes

Vendor Juniper Networks
Product Junos OS Evolved
Weakness CWE-476
Published April 12, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When Layer 2 traffic is sent through a logical interface, MAC learning happens. If during this process, the interface flaps, an Advanced Forwarding Toolkit manager (evo-aftmand-bt) core is observed. This leads to a PFE restart. The crash reoccurs if the same sequence of events happens, which will lead to a sustained DoS condition. This issue affects Juniper Networks Junos OS Evolved 23.2-EVO versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO.

Key dates

02Disclosure timeline

April 12, 2024 CVE published
August 2, 2024 Record updated